Risk and Improvement
AI Governance for Australian Nonprofits: Privacy, Risk & Compliance Guide
AI is rapidly reshaping Australia’s social and community services. Tools for case note summarisation, triage, transcription and safeguarding alerts are increasingly used by frontline teams.
But these benefits come with serious risks like privacy breaches, bias, inaccurate inferences, poor transparency and the potential for harm in sensitive service areas. As a result, AI governance is now a core leadership and board responsibility.
This guide explains current Australian expectations, risk considerations, and practical governance steps for NGOs, NFPs and community health providers.
Why AI Governance Matters for Australian NGOs (Regulations & Risks)
Australian regulators have strengthened expectations around AI use across both public agencies and funded social services. Key obligations include:
- The Privacy Act 1988 applies to all personal information used or created by AI – including inferred and inaccurate (“hallucinated”) data.
- OAIC guidance warns organisations not to input personal or sensitive information into public AI tools like ChatGPT or Gemini.
-
Government AI guidelines (including procurement rules) now influence requirements for funded NGOs, even if not legally mandated.
- States like Queensland require structured AI governance, transparency and documentation.
- Trauma‑informed practice, cultural safety, and frameworks like MARAM cannot be automated or delegated to AI systems.
Practice Requirements
- Trauma‑informed practice, cultural safety, and frameworks like MARAM cannot be automated.
- AI must never replace professional judgment in high‑risk or complex client scenarios (family violence, mental health, child safety, disability).
For organisations handling highly sensitive data, these safeguards are essential.
Common Types of AI Used in Australian Community Services (and Related Risks)
1. Productivity, Case Notes & Documentation Tools
Frontline staff commonly use AI to summarise notes, generate letters or draft reports.
- Microsoft 365 Copilot: Ensure correct tenant configuration, data residency and governance.
- ChatGPT & Gemini (public versions): High risk due to data transfer to external servers—no identifiable information should ever be entered (check OAC guidance)
- Transcription apps (Otter.ai, Fireflies, Read.ai): Check consent requirements, recording laws and overseas storage.
2. Client & Case Management Systems
Platforms like Lumary, SupportAbility and CareMaster increasingly embed rules‑based and machine‑learning features (eg predictive rostering, pattern detection).
Governance requirement: Treat embedded automation as AI, especially when influencing client outcomes or service decisions.
3. Intake, Triage & Crisis Navigation Tools
Some NGOs are using AI for crisis navigation, service triage and call summarisation.
Risks:
- People may not know AI is collecting or processing their information.
- AI must never replace practitioner-led risk assessment in family violence or mental health contexts.
4. Safeguarding, Incident Monitoring & Pattern Detection
Emerging AI systems detect crisis escalation, repeated contacts, anomalies or risk patterns.
Governance implications:
- These uses must meet principles of fairness, accountability and contestability.
- Boards must require human oversight, explainability and escalation pathways.
5. Internal Knowledge Assistants & Policy Tools
Lower risk tools that summarise policies, guide staff to procedures or assist with compliance.
Still requires:
- Role‑based access
- Documentation
- Privacy impact assessments where personal information is involved
Legal, Ethical & Sector Requirements
Privacy & Data Protection
NGOs must:
- Address potential AI bias and impacts on marginalised communities
- Respect Indigenous Data Sovereignty principles
- Disclose AI use in privacy policies when it:
- influences service decisions
- collects or processes personal information
- generates inferred client data.
Sector-Specific Obligations
Particularly for family violence, youth services, mental health, disability and addictions:
- Trauma‑informed practice must guide all AI-supported activities
- MARAM and clinical governance frameworks cannot be automated
- Human review is mandatory for all decisions that affect client safety and wellbeing.
Board Responsibilities and Governance Checklist
1. Oversight
- Maintain an AI register.
- Require Privacy Impact Assessments (PIAs) and AI Impact Assessments
- Approve procurement standards for AI‑enabled tools
2. Safety & Ethics
- Define decisions that must remain human-led (risk assessment, clinical decisions).
- Ensure AI use supports trauma‑informed, client‑centred practice.
3. Cultural Safety & Equity
- Respect First Nations data governance principles.
- Recognise the prevalence and impacts of bias in AI tools
- Ensure cultural safety in policies and practices for Responsible AI use
4. Risk & Documentation
- Integrate AI into your Risk Register.
- Maintain records of your decisions, training and approvals.
- Ensure role‑based access and data controls.
5. Transparency
- Update privacy policies.
- Inform service users when AI is used in their data processing.
Summary: For Leaders and Boards
- AI use triggers significant privacy obligations.
- Boards – not IT – hold governance responsibility.
- Sensitive data must never enter public AI tools.
- AI must not replace practitioner risk assessment.
- Cultural Safety is a core requirement of responsible AI use.
- Transparency and human oversight are non‑negotiable.
Frequently Asked Questions
Can Australian NGOs use ChatGPT for case notes?
Usually no. Personal, sensitive or identifiable client information must not be entered into any publicly accessible AI tool, including ChatGPT, Gemini, low‑cost AI bots, or consumer‑tier versions of Copilot.
Case notes should always be:
- written contemporaneously with the event
- specific to the client and context
- based on the practitioner’s professional judgement
- defensible and able to be explained by the writer if reviewed
The OAIC explicitly warns organisations not to input identifiable information into public AI tools, as these systems may store, transmit or reuse data outside your control. Because case notes contain highly sensitive client information, they cannot be safely or lawfully created, summarised or drafted using public AI applications.
Secure, organisation‑approved tools with correct governance, data residency and access controls must be used instead.
Do NGOs need AI Impact Assessments?
Yes—expectations for public agencies now flow directly to funded NGOs.
Assessments help identify and manage risk and demonstrate responsible AI use.
What AI decisions must always remain human-led?
Family violence risk assessment, clinical judgment, safety planning and any decisions affecting a person’s wellbeing.
Are transcription apps safe for sensitive meetings?
Only with explicit informed consent, lawful recording and secure data storage.
What Is Organisational Justice and Why It Matters for Psychosocial Safety
Organisations work best when people feel respected, valued, and treated fairly. At The Policy Place, we focus on helping workplaces build fairness through clear, consistent, and inclusive policies. We have recently updated our health and safety and risk management policies to better address psychosocial hazards, including the effects of poor organisational justice.
This guide explains what organisational justice means, why it matters, and how employers can build fair and healthy workplaces in Queensland and New Zealand.
What Is Organisational Justice?
Organisational justice is about fairness at work. It includes how decisions are made, how people are treated, and how policies are applied.
When workers feel their workplace is fair, they are more likely to:
- trust their leaders
- feel safe speaking up
- be engaged and productive
- work well with others
When fairness is missing, it can create stress, conflict, confusion, and even psychological harm.
Signs of Poor Organisational Justice
Poor organisational justice can show up in many ways. Common examples include:
1. Privacy Breaches
Sharing personal information without consent or discussing performance in front of others.
2. Inconsistent Policies
Applying rules differently to different people
3. Unfair Penalties
Blaming workers for issues outside control.
4. Cultural Insensitivity
Ignoring cultural needs or practices.
5. Lack of Reasonable Accommodations
Failing to support staff with accessibility needs or health concerns.
6. Discrimination
Treating some groups unfairly or applying policies unevenly.
7. Poor Handling of Misconduct
Not investigating complaints or failing to follow due process.
8. Unfair Work Allocation
Favouring certain people for shifts or opportunities.
9. No Clear Decision Process
Not explaining why decisions are made or what criteria were used.
How to Build and Maintain Organisational Justice
Below are practical, policy-aligned strategies to reduce psychosocial risks and promote fairness in your workplace.
1. Monitor Bias in Processes
Regularly review recruitment, promotion, and decision-making processes to identify and reduce bias.
2. Ensure Clear Workplace Expectations
Make sure everyone understands your Kaupapa, organisational values, Code of Conduct, and performance standards.
3. Strengthen Privacy & Confidentiality
Use training, policies, and clear procedures to ensure staff understand their obligations.
4. Provide Reasonable Accommodations
Create accessible, equitable workplaces that support all workers—including during onboarding.
5. Make Reporting Safe & Transparent
Offer clear pathways for raising concerns, including anonymous options, and ensure timely follow-up.
6. Maintain Open Communication
Share updates about organisational changes, policies, and decisions regularly and transparently.
7. Prevent Nepotism & Favouritism
Use transparent recruitment and selection processes and actively manage conflicts of interest.
8. Provide Regular Feedback
Adopt a “no surprises” approach to performance management by offering frequent, constructive feedback.
9. Use Fair Disciplinary Processes
Ensure disciplinary actions follow proper procedures and meet standards of procedural and substantive fairness.
10. Promote Cultural Competency
Offer training and guidance that improves cultural awareness and helps prevent unconscious bias.
11. Support Hauora / Wellbeing
Include psychosocial hazards in health and safety planning and give workers a say in risk controls.
12. Build Inclusive Policies
Review policies regularly to ensure they reflect Te Ao Māori, cultural safety, and equity principles.
13. Encourage Peer Support & Development
Create opportunities for debriefing, supervision, and collaborative problem‑solving.
14. Provide Mentorship
Support new staff and underrepresented groups with structured mentoring and development pathways.
15. Keep Communication Channels Open
Use hui, surveys, anonymous feedback tools, and suggestion boxes to encourage dialogue.
16. Celebrate Diversity
Recognise cultural events and promote a workplace where everyone feels valued.
17. Model Strong Leadership
Leadership must demonstrate transparency, fairness, and accountability—one standard for all.
How to Improve Organisational Justice
Improving fairness does not have to be complicated. Small and consistent steps can make a big difference.
1. Review Processes for Bias
Regularly check recruitment, promotion, and decision‑making to reduce bias.
2. Set Clear Expectations
Share organisational values, codes of conduct, and performance standards.
3. Protect Privacy
Train staff to handle information responsibly.
4. Provide Accommodations
Support workers with health, disability, cultural, and accessibility needs.
5. Offer Safe Reporting Options
Make it easy for staff to raise concerns and receive timely follow‑up.
6. Communicate Transparently
Explain decisions and share updates clearly and consistently.
7. Prevent Favouritism
Use transparent and accountable recruitment and selection processes.
8. Give Regular Feedback
Use a “no surprises” approach and support staff to improve.
9. Follow Fair Disciplinary Processes
Apply policies consistently and ensure procedural fairness.
10. Build Cultural Competency
Provide training to improve cultural awareness and reduce unconscious bias.
11. Support Worker Wellbeing
Include psychosocial risks in your health and safety planning.
12. Review Policies Regularly
Check that policies are inclusive and reflect cultural safety practices.
13. Encourage Peer Support
Create opportunities for supervision, debriefing, and team planning.
14. Provide Mentoring
Support new and underrepresented staff to learn, grow, and build confidence.
15. Keep Communication Open
Use hui, feedback sessions, and anonymous options to gather ideas.
16. Celebrate Diversity
Acknowledge cultural events and encourage inclusion.
17. Model Fair Leadership
Ensure leaders set the tone with consistent and respectful behaviour.
The Risks of Poor Organisational Justice
Poor organisational justice is a psychosocial risk. It can lead to:
- stress
- burnout
- psychological injury
- low morale
- high turnover
- poor team culture
Like any hazard, it must be identified, monitored, and either eliminated or controlled.
Conclusion
Fairness is essential for wellbeing, safety, and productivity. When workers feel respected and included, they are more engaged, more trusting, and more committed. Strong organisational justice creates a safer workplace and a healthier culture.
At The Policy Place, we support organisations to build fairness through clear policies, practical tools, and culturally responsive guidance.
Frequently Asked Questions
1. What is organisational justice in the workplace?
Organisational justice refers to the perception of fairness in workplace processes, decisions, and interactions. It includes fair treatment, transparent communication, and consistent application of policies. High organisational justice supports wellbeing, trust, and positive workplace culture.
2. Why is organisational justice important for health and safety?
Organisational justice is a recognised psychosocial factor that influences worker wellbeing. Poor fairness can increase stress, lower morale, and contribute to psychological injury. Fair and transparent processes help create safer, healthier workplaces.
3. What are examples of organisational injustice?
Common examples include inconsistent disciplinary decisions, privacy breaches, favouritism, cultural insensitivity, unfair work allocation, and poorly managed complaints. These issues can harm wellbeing and undermine workplace trust.
4. How can employers improve organisational justice?
Employers can improve organisational justice by creating clear policies, applying decisions consistently, preventing bias, providing transparent communication, offering safe reporting channels, ensuring cultural competency, and involving workers in decision‑making.
5. Are psychosocial hazards linked to organisational justice?
Yes. Poor organisational justice is considered a psychosocial hazard because it can cause stress, burnout, and psychological harm. Managing organisational justice is part of meeting Work Health and Safety obligations in both Queensland and New Zealand.
6. How does organisational justice benefit workplaces?
Benefits include higher trust, stronger engagement, increased productivity, reduced turnover, fewer conflicts, healthier teams, and overall improved organisational performance.
Best System for Keeping Policies Up to Date in NZ
Keeping policies current isn’t just about compliance — it’s about protecting your organisation, your staff, and the people you serve. In social and health care agencies, outdated policies can expose you to risk, compromise care, and weaken trust (see here for our blog about risks of outdated policies).
So, what’s the best system for keeping policies updated? Let’s compare four common approaches.
📄 Using General Templates
Pros:
- Low upfront cost (often free or cheap).
- Quick to access and download.
Cons:
- Too generic & often inappropriate for social or health care.
- Rarely updated with legislation changes.
- High audit risk.
Verdict: Suitable only as a temporary fix.
🛠 Doing It Yourself
Pros:
- Full control and tailoring.
- Embeds your values and sector priorities.
Cons:
- Time‑intensive, requires specialist knowledge (expensive when costed).
- Risk of missing updates.
- Vulnerable if staff leave.
Verdict: Works if you have governance expertise, but risky for most agencies. (DIY v Expert)
💼 Expensive HR Software
Pros:
- Automated updates and reminders.
- Integrated with HR systems.
Cons:
- Very high subscription costs (based on per user).
- Designed for corporate HR, not social care & not-for-profits.
- Policies don’t cover all operational and governance areas.
Verdict: Reliable for HR, but poor fit for human services and sector‑specific compliance.
🌐 The Policy Place Online Policies
Pros:
- Tailored for social, health, disability, iwi, and creative sectors.
- Audit‑ready and aligned with NZ law, regulations (eg Ngā Paerewa) and Te Tiriti.
- Regularly updated for legislative and sector changes.
- Affordable compared to HR software and the cost of time and effort with DIY.
Cons:
- Requires subscription or purchase.
- Best for organisations valuing defensibility and cultural safety.
Verdict: Balanced option for agencies needing reliable, sector‑specific policies.
Comparison
| Option | Cost | Suitability (Social/Health Services) | Reliability |
| General Templates | Low | Poor-too generic | Low |
| Do It Yourself (DIY) | Hidden/high | Moderate- depends on expertise | Variable |
| Expensive HR Software | Very high | Low- corporate focus; narrow focus | High (for HR) |
| Policy Place Online | Moderate/fair | High – sector specific | High |
❓ FAQs
Q: How often should policies be updated in social and health care agencies?
At least annually for any fast-moving area, or whenever legislation or sector standards change.
Q: Are free policy templates safe to use?
They can be a starting point, but they rarely meet audit or compliance standards.
Q: What makes The Policy Place different from HR software?
Policy content is specifically designed for the human services – ie social services, health and a range of community services It’s aligned with NZ regulatory frameworks without the high corporate charges. Covers policies in Governance, Health and Safety, Quality Assurance, Service Delivery, Integrity, HR, Cybersecurity and more.
✅ Conclusion
For agencies in social and health care, the real question isn’t just “how do we keep policies up to date?” but “how do we keep them defensible, sector‑specific, and practical?” General templates and DIY approaches often fall short. HR software is costly and misaligned. The Policy Place offers a middle ground: affordable, reliable, and tailored to the realities of your sector.
👉 Explore The Policy Place online policies today — designed for agencies like yours.
Policies in the age of AI Hallucinations
In our everyday life, we wouldn’t rely on a person for advice who is known to hallucinate from time to time in their advice-giving. For the same reason, we cannot solely rely on generative AI tools for policy advice and development.
In this post, we focus particularly on the AI risk of “hallucination” and error and how best to manage these risks.
Hallucinations
Hallucinations are a well-known risk of using generative AI. They occur when an AI model makes up facts to respond to a prompt. They reflect that AI models are predictive systems designed to produce the most probable and plausible answer, not necessarily the most accurate or truthful answer.
It can be hard to identify an AI hallucination because they are typically framed in a convincing way.
Why are AI outputs so convincing when they are wrong?
I asked ChatGPT this question.
In its own words, the chatbot explained that “it was trained to sound convincing, not to be right.” In other words, the chatbot’s hallucinating is due to its training that a confident answer is more likely to be viewed as helpful than a hesitant answer; likewise that an answer that has the indicators of expertise (like tone and terms) is more likely to be seen as credible and reliable. AI has learned and reflects the shape and appearance of expertise without necessarily having the expertise itself.
This is quite a different scenario from how AI is sold – see, for example, the description of ChatGPT5 by the CEO of OpenAI as like having a “team of Ph.D. level experts in your pocket.” (NBC News Aug. 8, 2025)
AI at The Policy Place
At the Policy Place we use AI to assist our policy development and review work. We treat it like a junior policy assistant who can help us with a range of tasks like initial drafts, summaries etc We use other sources too like legislation, regulations, government websites, academic research and court and tribunal decisions for the development, reviews and updating of policies and procedures.
We have previously posted about the highly publicised Deloitte case where AI-generated citations used in a report for the Australian Government were found to be wrong and included fictitious citations. There have also been a number of legal cases reported overseas of AI used in cases and found to have produced fictional case citations and other inaccuracies. See here for a good list of Australian examples.
We understand how easily mistakes like this could happen. Unlike other sources we use, we find that checking AI outputs for hallucinations and errors is hugely time-consuming.
It is not only hard to spot hallucinations. When using AI, we have noticed that more data is generated by our prompting than if we did the whole task by hand. Sometimes, this is helpful and right on point. Other times, it can be completely superfluous and tie us needlessly up in checking and re-checking processes.
So we’re still a work in progress, striving for the productivity and efficiency gains of AI use while wanting to maintain our high standards for accuracy and quality in our policies.
Can AI check and verify?
If only we could rely on AI to do this. But we can’t.
At best we can ask AI to verify its outputs against its own training data. It cannot check and verify its outputs against sources like legislation, organisational documents, academic databases and expert reports. It cannot assess the truth or veracity of something.
With RAG – Retrieval-Augmented Generation – things are better. Hallucination risks are significantly reduced because AI answers are grounded in authorised content. AI outputs are also more consistent. But the truth and reliability of AI outputs depends on the authorised content/data.
Thinking about AI for policies?
If you’re thinking about using AI for your policies, think beyond the promises and “sell” of AI. Ensure you have the expertise and knowledge to check the AI outputs for quality, accuracy and hallucinations. Be pro-active about managing the risks of hallucinations and errors and ensure you have good policy guidelines for effective governance and management of AI.
Wanting to outsource your policies and procedures and the assurance of relevant policy expertise? Contact us NOW at The Policy Place.
Call us now
How to Use AI for Writing Policies (Without Getting Burned)
Artificial Intelligence (AI) tools like ChatGPT and Gemini are changing the way we work — and policy writing is no exception. These tools can help you get started quickly, giving you draft content in seconds instead of days. But when it comes to policies and procedures for your business or organisation, speed alone isn’t enough.
At The Policy Place, we think AI can be useful — if you know how to use it safely. Here’s how to make the most of AI tools to draft policy content without putting your organisation at risk, and where expert support still matters.
Step 1: Use AI to Get a First Draft or Template
AI tools are great at producing a basic structure. You can ask something like:
“Write a policy on remote working for a small not-for-profit organisation in New Zealand.”
You’ll often get a reasonable starting point: a definition, purpose, roles, responsibilities, and maybe a few procedures. This can help overcome blank-page syndrome and give you something to work from.
Good use
-
Exploring structure and headings
-
Drafting general content
-
Brainstorming risks or responsibilities
BUT Warning
AI content is often vague, outdated, or based on generic international templates that don’t reflect NZ laws or your specific sector. Sometimes it’s wrong.
Step 2: Review the Content Critically
Just because something is well written doesn’t mean it’s accurate or compliant. You really have to review the content to check it is consistent with our law and othe regulatory criteria that applies to your organisation and that properly reflects your mission, values and purpose (kaupapa).
Remember, unless instructed, AI doesn’t know:
- Which New Zealand legislation applies to your organisation/business
- Your funding contracts or audit requirements
- Your operational needs
- Your kaupapa (mission, values, aims)
- Whether content is up to date with sector standards
That’s where the risks start. Many AI policies can look good but won’t hold up in an audit — or worse, if something goes wrong.
Step 3: Ask for Help to Make It Real
This is where we come in. At The Policy Place, we don’t throw out your AI-generated draft — we aim to get the most from AI to build faster and better policies for your organisation. We:
- Review and provide online policies to support compliance, clarity, and accuracy
- Enable you to tailor policies to your needs and legal obligations
- Check and monitor your online policies for quality and currency
- Update it as laws, contracts, and sector standards change
AI is a tool. It’s not an advisor, an auditor, have regulatory and quality expertise or the exertise of real-life management of diverse agencies.
Example: AI Draft vs Expert Review
AI version:
“All staff are expected to comply with data protection laws.”
Expert-reviewed version:
“Staff must comply with the Privacy Act 2020 and the Information Privacy Principles. The Privacy Officer is responsible for managing access requests, ensuring privacy training is completed annually, and reporting breaches to the Privacy Commissioner where required.”
Spot the difference? That’s the value of combining AI efficiency with real-world expertise.
Use AI — But Don’t Go It Alone
We encourage people to explore and use AI tools. They can be immensely helpful. They’re fast. But they don’t know your risks, obligations, or context. That’s why AI should be a starting point, not your final product.
If you want peace of mind knowing that your policies are developed, checked and reviewed against relevant standards by real lives humans with relevant expertise and experience, or if you want to build a system where AI and expert review work together, talk to us.
Ready to Future-Proof Your Policies?
Let’s work together to make your policies smart, practical, and compliant — with or without AI.
📩 Contact The Policy Place today — your policies are too important to leave to chance.
The Risks of Outdated Policies: What Your Organisation Needs to Know
In today’s fast-paced environment, staying effective means keeping every aspect of your operations up to date – especially your policies.
Outdated policies can lead to more than inefficiencies; they can result in significant financial, reputational, and operational risks. This is particularly important for any business and agency when resources are limited, and trust is paramount. Let’s explore the risks of outdated policies and why proactive policy management is essential for every organization.
Financial Risks: The Hidden Costs of Outdated Policies
One of the most immediate consequences of outdated policies is non-compliance with laws and regulations. Regulatory frameworks evolve regularly, and failure to keep policies aligned can result in:
- Hefty Fines and Penalties: Community and not-for-profit agencies are not immune to regulatory oversight. Non-compliance with laws such as health and safety regulations, privacy law, or employment standards can lead to fines and penalties that strain already tight budgets.
Example: In Aotearoa, failure to comply with employment law can lead to personal grievance action and ultimately to financial sanctions; non-compliance with the Health and Safety at Work Act 2015 can lead to fines of up to $600,000 for individuals or $3 million for organisations.
- Funding Risks: If you’re dependent on government or philanthropic funding, non-compliance or poor policy management can jeopardise funding agreements.
Example: Contracts with government agencies to provide services typically require compliance with regulatory standards like the Social Sector Accreditation Standards, Ngā Paerewa Health and Disability Service Standards. If you’re a business, iwi or community agency contracted to provide community housing, you must comply with the Performance Standards….. If you don’t keep your policies updated, this can lead to non-compliance with these standards and ultimately, result in loss of funding. t
- Increased Insurance Premiums: Non-compliance or repeated claims stemming from inadequate policies can raise insurance costs, which can be particularly burdensome for not-for-profits.
Reputational Risks: Outdated Policies Damage Trust
For all businesses and agencies, a good reputation is important. Outdated policies can jeopardise this and severely damage trust among stakeholders, current and potential clients, donors, and the public:
- Negative Publicity: A privacy breach or safety violation resulting from an outdated policy can lead to negative media coverage, harming your organisation’s credibility.
- Loss of Stakeholder Confidence: Funders, partners, whānau and community expect organisations and businesses want to deal with creditable and trustworthy organisations. Outdated policies can signal negligence and erode trust and confidence of staff and actual and potential clients, partners and funders.
- Impact on Volunteer Engagement: Community agencies often rely heavily on volunteers. However, volunteers may hesitate to support organisations with poor policy management, perceiving it as disorganized or unsafe.
Operational Risks: Efficiency Suffers Without Updated Policies
Outdated policies can hinder day-to-day operations, leading to inefficiencies and disruptions:
- Confusion Among Staff and Volunteers: Policies that are unclear or out of sync with current practices create confusion and inconsistent application.
- Delays in Decision-Making: Outdated policies may not address new challenges or scenarios, slowing decision-making processes. (See Good Decisions need Good Policies.)
- Increased Errors: When policies fail to reflect current best practices or technological advancements, errors are more likely, impacting service delivery.
The Benefits of Updating Policies
Keeping policies current isn’t just about avoiding risks; it’s about empowering your organisation and business to succeed. Updated policies:
- Enhance Compliance: Proactively address legal and regulatory requirements.
- Improve Efficiency: Provide clear guidance to employees and volunteers, reducing confusion and errors.
- Build Resilience: Prepare your organisation to adapt to changes and challenges effectively.
Best Ways to Manage These Risks
Effectively managing the risks associated with outdated policies requires a proactive and systematic approach. Here are some best practices:
- Schedule Regular Policy Reviews: Set a timeline to review each policy, typically annually or whenever major regulatory updates occur.
- Leverage Technology: Join The Policy Place online policy service for policies that support your compliance and are regularly reviewed and updated for legal and other regulatory changes. With your policies taken care of, you can focus on policy implementation (Check out the benefits here.).
- Engage Diverse Stakeholders: Gather and include input and feedback from your stakeholders like clients, kaimahi/staff and community partners when updating your policies and seek out cultural and industry expertise in areas it is needed.
- Provide Ongoing Training: Ensure all your kaimahi and volunteers are trained and have a good understanding of your policies and how to access them. You can’t rely on your policies and procedures with staff and expect compliance if they don’t know about them!
- Conduct Audits: Arrange for checks and audits of case files and other documentation to ensure that policies are complied with. Where there is non-compliance, address it and strategise to prevent recurrence.
- Document and Communicate Updates: Clearly document any changes to policies and communicate them effectively across your organisation to avoid confusion. As a member of The Policy Place we keep your policies updated and keep you informed about updates.
How We Can Help with Policy Management
At The Policy Place we specialise in keeping your policies compliant, relevant, and effective. Our services include:
- Policy Development: We provide core policy content to support agencies to comply with the law and other regulations and to meet good sector and industry practice.
- Policy Monitoring & Review: We ensure that clients keep up with legislative and other regulatory changes.
- Comprehensive Policy Audits: Identify gaps and areas for improvement.
Whether you’re a business, a not-for-profit or other organisation, don’t let outdated policies hold you back. Contact us today to learn how we can help you minimize risks and maximize operational success.
How Organisational Policies can Promote and Protect Rights
In an increasingly complex world, the protection and promotion of human rights are more essential than ever. With political landscapes shifting toward conservatism in many countries, including Aotearoa/New Zealand, the rights of minorities are often left vulnerable.
But there is good news: organisations, whether they are businesses, or non-profits, have the power to champion human rights within their spheres of influence.
A practical and impactful way to achieve this is through organisational policies and procedures.
Why Organisational Policies Matter for Human Rights
Policies and procedures serve as the backbone of an organisation. They set expectations, guide behaviour, and establish accountability. More importantly, they reflect the values of an organisation. By embedding human rights principles into policies, organisations can:
- Foster Inclusive Workplaces: Policies that promote diversity, equity, and inclusion (DEI) and support the implementation of Te Tiriti o Waitangi help ensure that everyone feels valued and respected, regardless of their background. (For more, see our previous posts on the value of Treaty-based policies) and Cultural Responsiveness.
- Mitigate Discrimination and Harassment: Clear anti-discrimination and anti-harassment policies create safer spaces for kaimahi/employees, clients, and stakeholders.
- Influence Industry Standards: Organisations that model best practices can inspire others to follow suit, amplifying their impact.
Steps to Integrate Human Rights into Policies and Procedures
To transform organisational policies into tools for protecting and promoting human rights, here are some actionable steps:
- Conduct a Human Rights Audit: Evaluate existing policies and procedures to identify gaps or areas where human rights principles can be strengthened.
- For example, assess recruitment policies to ensure they actively address barriers faced by underrepresented groups.
- Integrate Human Rights in Core Policies: Incorporate explicit commitments to human rights into key organisational documents, such as:
- Codes of Conduct: Outline expectations for respectful and inclusive behaviour.
- Supplier Agreements: Require suppliers to adhere to ethical practices and environmental standards.
- Whistleblower Policies: Ensure kaimahi/employees can report rights violations without fear of reprisal.
- Provide Ongoing Education: Equip kaimahi/staff with the knowledge and tools to uphold human rights in their daily roles. Training sessions on unconscious bias, cultural competency, and ethical decision-making can build awareness and skills.
- Engage in Advocacy: Organisations can use their platforms to advocate for human rights externally. For instance, a business could publicly support policies that advance Indigenous rights or LGBTQ+ inclusion.
- Monitor and Adapt: Regularly review and update policies to respond to evolving societal needs. Engage with stakeholders, including employees and community representatives, to ensure policies remain relevant and effective.
Examples of Organisations Championing Human Rights Through Policies
Many organisations are already leading the way in promoting human rights through their policies:
- Social, Health and Community Services: Across Aotearoa, New Zealand, many organisations have policies and strategies to prioritise equitable access to services, ensuring no one is left behind.
- Local Authority policies for inclusive public transport to ensure accessibility for people with disabilities (eg Auckland Transport DEI policy)
- The Policy Place: We are proud to provide human rights-focused policies for diverse organisations that reflect our commitment to human rights. Our work includes supporting agencies with online policies addressing Te Tiriti o Waitangi, Cultural Responsiveness, and Diversity and Inclusion, ensuring that these principles are not only acknowledged but actively upheld.
The Ripple Effect of Human Rights Policies
When organisations commit to protecting human rights, they contribute to a ripple effect that extends far beyond their walls. Kaimahi/employees bring inclusive practices into their personal lives. Clients and customers are inspired by ethical leadership. And industries begin to view human rights as essential, not optional.
In a time when governments may falter in safeguarding rights, organisations have the opportunity to step up and lead. By leveraging policies and procedures as tools for change, they can create environments where everyone—regardless of race, gender, ability, or background—can thrive.
Call to Action
Whether you’re a business owner, a manager, or a team member, consider the role your organisation plays in promoting human rights. Take a closer look at your policies. Do they reflect your values? Are they making a tangible difference? If not, it’s time to take action.
The future of human rights doesn’t just depend on governments. It depends on all of us. Together, we can build organisations—and societies—that are fairer, safer, and more inclusive for everyone.
Top Compliance Risks for Businesses in 2025 and How to Address Them
In today’s fast-changing technological and regulatory environments, compliance risks for businesses are significant. Businesses face increasing scrutiny from regulators, customers, and other stakeholders to meet legal obligations and uphold best practices. As 2025 unfolds, here are the top compliance risks businesses need to be aware of—and strategies to address them effectively.
1. Data Privacy and Cybersecurity
With the growing prevalence of data breaches and stricter privacy laws, data protection strategies are non-negotiable for all businesses. Laws like the Privacy Act 2020 and global regulations such as the GDPR are evolving, placing higher demands on businesses to safeguard customer and employee data.
How to Address It:
- Conduct regular audits of your data handling processes.
- Implement robust cybersecurity measures, such as encryption and multi-factor authentication.
- Provide training for staff/kaimahi on data privacy and security protocols.
- Ensure your policies reflect the latest regulatory requirements and technological advancements.
2. Workplace Health and Safety Compliance
Health and safety remain top priorities, with regulators closely monitoring workplace standards. This includes ensuring compliance with the Health and Safety at Work Act 2015, particularly for higher-risk industries. Our Health and Safety regulatory system including the Health and Safety Act is currently being reviewed. The review may result in changes affecting your policies and processes.
How to Address It:
- Regularly review and update your health and safety policies and processes.
- Engage kaimahi/staff in health and safety training and drills.
- Stay informed about the Health and Safety Review and industry-specific guidelines and best practices.
3. Environmental, Social, and Governance (ESG) Obligations
ESG compliance is no longer optional. Stakeholders demand transparency about how businesses impact the environment and society and stakeholder accountability. We all play a vital part in reducing emissions, waste management, and sustainable practices and organisations across every sector have responsibilities.
How to Address It:
- Create or update your ESG policies to align with current regulations and industry standards.
- Prevent harm to current and future generations
- Recognise that business assets and profitability rest, in the long run, on environment, social and cultural respect.
- Monitor your environmental impact and sustainable practice.
- Communicate ESG efforts to stakeholders, showcasing accountability and progress.
4. Anti-Money Laundering and Countering Financing of Terrorism
Financial regulations require businesses to identify and mitigate risks related to money laundering and terrorism financing. Non-compliance can lead to severe penalties and reputational damage.
How to Address It:
- Ensure your policies comply with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009.
- Implement robust customer due diligence processes.
- Train kaimahi/staff on identifying suspicious activity and reporting obligations.
5. Employment Law Compliance
Employment law violations, such as failing to meet wage and holiday requirements or mishandling workplace disputes, can result in costly penalties and harm to workplace morale. Recent and proposed changes in Aotearoa to employment law relating to employment status, the minimum wage and personal grievances highlight the importance of staying current.
How to Address It:
- Review workplace policies regularly and employment agreements to ensure agreements align.
- Ensure all your kaimahi/staff are familiar with your policies and procedures and kept informed about changes.
- Provide training to all management levels on fair treatment and dispute resolution.
- Monitor updates to employment legislation and ensure your policies are kept current.
6. Consumer Protection and Marketing Compliance
Misleading advertising, false claims, or breaches of the Fair Trading Act 1986 and the Consumer Guarantees Act 1993 can lead to legal action and loss of consumer trust.
How to Address It:
- Ensure marketing materials comply with advertising standards and consumer laws.
- Train staff on ethical sales practices and accurate representation of products or services.
- Monitor feedback channels to identify and address consumer complaints promptly.
How We Can Help
Keeping up with regulatory changes can be overwhelming, but you don’t have to do it alone. Our policy management service takes the guesswork out of compliance. We provide:
- Policy content updated to reflect the latest laws and standards.
- Tools to track staff awareness and adherence to policies.
- Regular policy reviews to ensure your business remains compliant.
By outsourcing your policy management, you save time, reduce risks, and gain peace of mind knowing your policies are always current and compliant.
Final Thoughts
Compliance risks are an ever-present challenge for businesses, but they’re manageable with the right approach. By staying proactive and partnering with experts, you can protect your business, maintain trust, and focus on growth in 2025 and beyond.
Contact us today to learn how we can support your compliance needs!
Aligning with Family Violence Standards: Policy Reviews
At The Policy Place, we are committed to regularly reviewing and updating our online policies to ensure they meet the highest standards and reflect the latest developments in the field. Our next review will focus on policies related to abuse, child protection, and safeguarding vulnerable adults.
These policies are crucial for compliance with the Social Sector Accreditation Standards, Health and Disability Standards, and legislation such as the Children’s Act 2014.
Our Review Process
When we review and update our online policies, we take into account feedback from our members, as well as current laws, regulations, and best practice codes. This comprehensive approach ensures that our policies are not only compliant but also practical and effective for our diverse membership.
In the upcoming review, we will be incorporating two significant developments: the Specialist Family Violence Organisation Standards and the Recommendations of the Royal Commission on Abuse in Care. These updates are essential to ensure our policies remain relevant and effective in addressing the needs of those we serve.
The Importance of Specialist Family Violence Organisation Standards
The Specialist Family Violence Organisation Standards (“the Standards”) are a set of comprehensive guidelines developed as part of Te Aorerekura: The National Strategy to Eliminate Family Violence and Sexual Violence. These standards aim to guide consistent and high-quality practice among organizations providing services to individuals affected by family and sexual violence.
Key Features of the Standards
The Standards reflect extensive collaboration and insights from professionals in the family violence and sexual violence sectors, tangata whenua, community representatives, agencies, and victim-survivors. For organisations like ours, they provide a valuable framework for revising and updating policies and procedures. Key criteria include:
- Recognition of various forms of family violence: Including child abuse, elder abuse, and sexual violence, and the differing impacts based on cultural, gender, and care dynamics.
- Ensuring safety and autonomy for victim-survivors: Entailing provision for direct and indirect service users and for the safety and wellbeing of tamariki even when children are not direct service users.
- Victim and whānau-centered risk assessment and safety planning: Conducted in a culturally responsive manner and reflecting knowledge of family-violence related risk factors (eg separation, pregnancy).
- Supporting a trauma and violence-informed approach: a focus on the impact of violence (distinct from other causes of trauma) on individuals and communities and recognising interconnected experiences of interpersonal and systemic violence.
- Reflecting a ‘primary victim-survivor, predominant perpetrator’ analysis: – Reflected in policies and procedures around risk assessment, planning and service delivery.
- Recognising and addressing the rights and interests of deaf and disabled individuals and adults needing safeguarding – addressing the contexts of care and impacts of stigma and misinformation.
- Promoting culturally safe and appropriate practices: – Recognising intersectionalities and impacts for people of diverse genders, ethnicity and abilities.
How The Standards Apply
The Standards are vital for organisations providing specialist family violence responses but can also be utilised by any organization wanting to enhance their response capabilities and organisational practices. They complement existing accreditation and practice frameworks from agencies like the Ministry of Justice, Te Kāhui Kahu and the Ministry of Social Development.
The Policy Place Abuse and Protection policies are already aligned with many aspects of the Standards, such as cultural responsiveness, safety planning, and legislative references.
However, we strive to do more. Through review and updating, Policy Place members operating in social service, health, disability and justice sectors will have their policies more specifically aligned to the Standards. Members will therefore gain the assurance that their policies:
- Comply with legal and regulatory requirements: And reflect best practices.
- Are endorsed and utilised by different sectors: And comply with different accreditation criteria
- Guide the delivery of safe, inclusive, and responsive services: To diverse communities.
This helps build support national consistency in the application of the Standards because, as a leading provider of policies and procedures for agencies in NZ, our reviews and updates positively impact many organisations in Aotearoa. Nationwide, we are helping build a safer and more effective network of services and supports for those impacted by family and sexual violence.
Conclusion
Regularly reviewing and updating our policies is not just about compliance; it’s about ensuring that our members are equipped with the best tools and practices to provide safe, effective, and inclusive services. By aligning with the Specialist Family Violence Organisation Standards and incorporating feedback and new developments, we can support our members in delivering high-quality care and protection to those who need it most. Together, we can make a significant impact in the fight against family and sexual violence.
New- Policy Tracking and Reporting for Compliance and Efficiency Gains
We’ve just introduced Policy Tracking and Reporting for members of the Police Place’s online policy service.
This new function provides managers with valuable information about the views and use of organisational policies and procedures. It also offers evidence of compliance that organizations can use for audits and assessments, ensuring adherence to the Social Sector Accreditation Standards, Ngā Paerewa Health and Disability Standards and other relevant laws and regulations.
In this post, we’ll cover what Policy Tracking involves, its benefits and how to impelement and use this new function.
If you are a member of the online policy service let us know if you want access to the new function. If you are not yet a member, contact us NOW to discuss joining.
What is Policy Tracking
Policy Tracking reports on the use and views of an organisation’s policies. It tells you which of your policies have been viewed and by whom, within chosen timeframes.
Here’s an example of a Policy Report:
- The report can be specific to a staff member or group of staff.
- It can be specific to policy pages.
- It can consider policy views within your chosen timeframe. .
The Benefits
We added this function because clients were asking for it. Policy Tracking and Reporting will bring the following benefits:
- Enhanced Compliance: Policy tracking provides records of policy views that can be used to evidence compliance with policies and laws during audits and inspections. This transparency can protect an organisation from liability and shows a proactive approach to compliance.
- Risk Management: Ensuring that all staff have viewed and understood critical policies like the Code of Conduct, Health and Safety, and Complaints reduces the risk of non-compliance with laws and regulations and harmful consequences.
- Operational Efficiency: By automating the tracking of policy views, organisations can save time and resources that would otherwise be spent manually monitoring compliance.
- Improved Transparency and Responsibility: Policies should be a single source of truth for an organisation. Policy Tracking reminds staff of the need to keep themselves informed about revisions and updates to policies and helps steer organisational members in the same direction.
- Continuous Improvement: Policy Tracking will provide information that can help investigate workplace incidents or complaints and plan training and service improvements.
Beware of privacy implications
Policy Tracking involves handling staff personal information, so applying privacy safeguards is crucial:
- Inform Staff: Before implementing the Policy Tracking function, let staff know you are going to do it and the purpose behind it.
- Anonymise Data: When using the Tracking data for audit and assessment purposes, remove identifying information. Anonymised and aggregated data provides as good evidence of policy use as identifying data.
- Restrict Access: Only allow authorised personnel to access Tracking data to ensure personal information remains secure. Usually, access will be confined to management.
- Limit Data Use: Tracking data must not be used for any purpose unrelated to the reason it is gathered unless allowed by law.
- Transparency: Inform staff they can request access to the tracking data you collect about their access and use of policies.
Limitations of Policy Tracking
We’ve previously posted about the limitations of a compliance-focused approach to policy. The limitations apply to the new Policy Tracking function.
While policy tracking tells you if a person has looked at a policy, it does not tell you whether they understood the policy or whether the policy has been applied. That’s where our online courses come in. Check them out here. They are short online courses that support members and non-members of the online policy service in understanding and applying policies and procedures in a range of areas.
Conclusion
The new service for tracking staff views of policies and procedures promises many benefits for our online policy members. It will support our policy clients in building service quality and efficiency, reducing risk, and fostering a culture of transparency and responsibility.
If you want to use the Policy Tracking function and you’re one of our online policy service members, then just let us know. If you’re not an online policy service member but are interested in joining, contact us to discuss your policy needs and how we can assist.
Contact us NOW to enhance your compliance and operational efficiency with our new Policy Tracking and Reporting service.